v11.20.0
Breaking Changes📦 pnpmView on GitHub →
⚠ 2 breaking✨ 2 features🐛 5 fixes🔧 12 symbols
Summary
This release addresses a security vulnerability related to named registries by improving lockfile integrity and introducing registry-qualified keys. It also includes performance enhancements and fixes for proxy settings and dependency resolution.
⚠️ Breaking Changes
- Projects using `namedRegistries` with pnpm versions 11.1.0–11.19.x are semi-breaking. The lockfile no longer records tarball URLs for named-registry packages; these are now recomputed from the `namedRegistries` setting on demand. To fix, commit the lockfile diff generated by a non-frozen install on the new pnpm version. Ensure all collaborators are on this version or newer before updating the lockfile to prevent lockfile format flipping.
- Named registry aliases that shadow reserved dependency specifier prefixes (e.g., `file`, `link`, `workspace`, `runtime`, `npm`, `jsr`) are now rejected with `ERR_PNPM_RESERVED_NAMED_REGISTRY_NAME` instead of being silently shadowed.
Migration Steps
- If you use named registries, perform a non-frozen install on the new pnpm version to re-key entries. Commit the resulting lockfile diff. Ensure all collaborators are on this version or newer before updating the lockfile.
- If you mirror or proxy npmjs, point the `npmjs` alias at your mirror in `pnpm-workspace.yaml` (e.g., `namedRegistries: { npmjs: https://npm.internal.example.com/ }`).
- Replace usages of `@pnpm/util.lex-comparator` with `@pnpm/text.ordinal-comparator`.
- Replace usages of `@pnpm/config.nerf-dart` with `@pnpm/config.registry-auth-key`.
✨ New Features
- Introduced a new built-in `npmjs:` alias that resolves to `https://registry.npmjs.org/` without configuration, allowing dependencies to be pinned to the public registry even when the `registry` setting points elsewhere.
- The `pnpm licenses` and `pnpm sbom` commands now keep artifacts apart by including the registry alias in license records and the `repository_url` qualifier in SBOM components.
🐛 Bug Fixes
- An empty `http-proxy`, `https-proxy`, `proxy`, or `no-proxy` value no longer fails the install with `ERR_PNPM_INVALID_PROXY`. Empty settings are now read as unset.
- The env lockfile no longer pins `@pnpm/exe` alongside `pnpm` when the wanted pnpm version is 12 or newer, as `@pnpm/exe` is not published for it.
- Fixed the order in which pnpm matches a lockfile's recorded tarball URL against known registry URLs to ensure consistent matching.
- Dependency resolution is faster due to filtering package metadata once per packument when `minimumReleaseAge` is active, and reusing parsed semver versions and ranges.
- Security: `pnpm rebuild` now rejects lockfiles with path traversal in package names (e.g., `../../../escaped@1.0.0`) instead of running lifecycle scripts in unintended directories.